CVEs published December 26, 2022
88 CVEs were published on December 26, 2022: 13 critical, 17 high.
- Published
- 88
- Critical
- 13
- High
- 17
- Medium
- 57
- Low
- 0
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- Contest Gallery
- 16
- Bulk Delete Users by Email
- 2
- Booster for WooCommerce · Booster Plus for WooCommerce +1
- 1
- Brave UX for-the-badge
- 1
- CODESYS V3 containing the CmpUserMgr
- 1
- com.fasterxml.jackson.core:jackson-databind
- 1
- Contest Gallery Pro
- 1
- directus
- 1
- Eventify™
- 1
- github.com/goharbor/harbor
- 1
Critical 13
- CVE-2022-4120Stop Spammers Security < 2022.6 - Unauthenticated PHP Object InjectionStop Spammers Security | Block Spam Users, Comments, Forms
- CVE-2022-4047Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File UploadReturn Refund and Exchange For WooCommerce
- CVE-2022-4117IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLiIWS
- CVE-2019-11851The ACENet service in Sierra Wireless ALEOS before 4.4.9, 4.5.x through 4.9.x before 4.9.5, and 4.10.x through 4.13.x before 4.14.0 allows r
- CVE-2020-11101Sierra Wireless AirLink Mobility Manager (AMM) before 2.17 mishandles sessions and thus an unauthenticated attacker can obtain a login sessi
- CVE-2020-24600Shilpi CAPExWeb 1.1 allows SQL injection via a servlet/capexweb.cap_sendMail GET request.
- CVE-2021-45466In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to a
- CVE-2021-45467In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.ph
- CVE-2022-24116Certain General Electric Renewable Energy products have inadequate encryption strength.
- CVE-2022-24117Certain General Electric Renewable Energy products download firmware without an integrity check.
- CVE-2022-24118Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration.
- CVE-2022-24119Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell
- CVE-2022-26969In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.directus
High 17
- CVE-2021-24942Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code ExecutionMenu Item Visibility Control
- CVE-2022-4156Contest Gallery < 19.1.5.1 - Unauthenticated SQL InjectionContest Gallery
- CVE-2022-4158Contest Gallery < 19.1.5 - Unauthenticated SQL InjectionContest Gallery
- CVE-2022-4268Plugin Logic < 1.0.8 - Admin+ SQLiPlugin Logic
- CVE-2019-19705Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG b
- CVE-2019-9579An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products.
- CVE-2020-10650A deserialization flaw was discovered in jackson-databind through 2.9.10.4.com.fasterxml.jackson.core:jackson-databind
- CVE-2020-12067In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), a user's password may be changed by an attacker withou
- CVE-2020-12069CODESYS V3 prone to Inadequate Password HashingCODESYS V3 containing the CmpUserMgr
- CVE-2020-28191The console in Togglz before 2.9.4 allows CSRF.org.togglz:togglz-console
- CVE-2021-35065The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular eglob-parent
- CVE-2021-35951fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows an Unauthenticated Remote attacker to send a malicious firmware update via B
- CVE-2021-35953fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service (device outage) via crafted c
- CVE-2021-35954fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows physically proximate attackers to dump the firmware, flash custom malicious
- CVE-2021-38561golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing.golang.org/x/text
- CVE-2021-44758Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and
- CVE-2022-26964Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-f
Medium, low and unrated 58
- CVE-2021-4281Brave UX for-the-badge combine-prs.yml os command injectionBrave UX for-the-badge
- CVE-2022-4239Workreap < 2.6.4 - Subscriber+ Arbitrary Posts Deletion via IDORWorkreap
- CVE-2022-4242WP Google Review Slider < 11.6 - Admin+ Stored XSSWP Google Review Slider
- CVE-2022-3835Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSSKwayy HTML Sitemap
- CVE-2022-4160Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4151Contest Gallery < 19.1.5 - Admin+ SQL InjectionContest Gallery
- CVE-2022-4159Contest Gallery < 19.1.5.1 - Author+ SQL InjectionContest Gallery
- CVE-2022-4152Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4266Bulk Delete Users by Email <= 1.2 - User Deletion via CSRFBulk Delete Users by Email
- CVE-2022-4226Simple Basic Contact Form < 20221201 - Admin+ Stored XSSSimple Basic Contact Form
- CVE-2022-4110Eventify <= 2.1 - Admin+ Stored XSSEventify™
- CVE-2022-4227Booster for WooCommerce - Reflected Cross-Site ScriptingBooster for WooCommerce · Booster Plus for WooCommerce +1
- CVE-2022-4162Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4164Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-3840Google Apps Login < 3.4.5 - Admin+ Stored XSSLogin for Google Apps
- CVE-2022-4267Bulk Delete Users by Email <= 1.2 - Reflected Cross-Site ScriptingBulk Delete Users by Email
- CVE-2022-4154Contest Gallery Pro < 19.1.5 - Admin+ SQL InjectionContest Gallery Pro
- CVE-2022-4163Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4166Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4150Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4165Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4197Sliderby10Web < 1.2.53 - Admin+ Stored XSSSliderby10Web
- CVE-2022-4243ImageInject <= 1.17 - Admin+ Stored XSSImageInject
- CVE-2022-4042Paytium < 4.3.7 - Admin+ Stored XSSPaytium: Mollie payment forms & donations
- CVE-2022-4155Contest Gallery < 19.1.5 - Admin+ SQL InjectionContest Gallery
- CVE-2022-4157Contest Gallery < 19.1.5 - Admin+ SQL InjectionContest Gallery
- CVE-2022-4153Contest Gallery < 19.1.5.1 - Author+ SQL InjectionContest Gallery
- CVE-2022-4161Contest Gallery < 19.1.5 - Author+ SQL InjectionContest Gallery
- CVE-2022-4742json-pointer index.js set prototype pollutionjson-pointer
- CVE-2019-25085GNOME gvdb gvdb-builder.c gvdb_table_write_contents_async use after freeGNOME gvdb
- CVE-2018-16135The Opera Mini application 47.1.2249.129326 for Android allows remote attackers to spoof the Location Permission dialog via a crafted web si
- CVE-2019-13988Sierra Wireless MGOS before 3.15.2 and 4.x before 4.3 allows attackers to read log files via a Direct Request (aka Forced Browsing).
- CVE-2019-14802HashiCorp Nomad 0.5.0 through 0.9.4 (fixed in 0.9.5) reveals unintended environment variables to the rendering task during template renderingithub.com/hashicorp/nomad
- CVE-2019-18177In certain Citrix products, information disclosure can be achieved by an authenticated VPN user when there is a configured SSL VPN endpoint.
- CVE-2019-19030Cloud Native Computing Foundation Harbor before 1.10.3 and 2.x before 2.0.1 allows resource enumeration because unauthenticated API calls regithub.com/goharbor/harbor
- CVE-2019-9011In Pilz PMC programming tool 3.x before 3.5.17 (based on CODESYS Development System), an attacker can identify valid usernames.
- CVE-2021-30134php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST dataphp-mod/curl
- CVE-2021-35952fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker allows a Remote attacker to change the time, date, and month via Bluetooth LE Chara
- CVE-2021-39369In Philips (formerly Carestream) Vue MyVue PACS through 12.2.x.x, the VideoStream function allows Path Traversal by authenticated users to a
- CVE-2021-43395An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 20
- CVE-2021-44854An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2021-44855An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2021-44856An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.
- CVE-2022-24120Certain General Electric Renewable Energy products store cleartext credentials in flash memory.
- CVE-2022-29852OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.
- CVE-2022-29853OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.
- CVE-2022-30260Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no
- CVE-2022-31469OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI.
- CVE-2022-36664Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter.
- CVE-2022-37307OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e
- CVE-2022-37308OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages.
- CVE-2022-37309OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name.
- CVE-2022-37310OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&c
- CVE-2022-37311OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet.
- CVE-2022-37312OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet
- CVE-2022-37313OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record.
- CVE-2022-41765An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3.
- CVE-2022-41767An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3.